What is the difference between authentication and authorization?

In this article, we have taken two very important topics of the cyber world namely authentication and authorization. We shall also discuss the difference between the two terms which have a direct link to our security on the World Wide Web and other networks. 

Concept of Authentication

"Authentication involves the act of the confirmation of the truth regarding all the attributes of some entity or datum under the question". 

The authentication process is also linked up with the confirmation of the identity regarding the following aspects:

1. Confirmation of a person’s or software system’s or program’s identity.
2. Tracing of the origins of some artifacts.
3. Ensuring that what the labelling and packaging claims to be is what is that is actually in the product. 

There are three types of authentication methods which we have discussed below:

1. The first type: It involves accepting of identity proof given by some credible person who can provide evidence of the identity or the originator and the object under assessment in question.
2. The second type: It involves a comparison between the attributes of the object itself and what is known about the objects of same origin. But authentication of this type is quite vulnerable to forgery and calls for expert knowledge
3. The third type: It involves authentication on the basis of the external affirmations like documentation. 

Three factors need to be verified in authentication are:

1. Owner ship factors
2. Knowledge factors
3. Inherence factors

Concept of Authorization

- The process of authorization involves the act of the specification of the access rights to the resources.

- These are the resources that are involved with the computer security or information security in general.

- In particular these resources are used to access control to the security system and other desired information.

- To say it simply, authorization is the process of providing a definition for the access policy. 

- While the system is in operation, it makes use of the access control rules for making decisions regarding the rejection or approval of the access requests from the authenticated users or consumers. 

- Resources can be anything like:

1. Individual files
2. Items data
3. Computer devices
4. Computer programs
5. Functionality of the computer applications and so on.

- Consumers may be either computer users or computer programs or other devices on the system. 

- The access control process that is performed during the authorization involves two main phases as mentioned below:

1. Phase 1: This phase is known as the policy definition phase and involves authorization of the access.
2. Phase 2: This phase is known as the policy enforcement phase and involves acceptation or rejection of the access requests.

Differences between Authentication and Authorization

1. Verification of your identity: It means verifying who you are is called authentication whereas the verification of what you are authorized to do is called authorization. This is the simplest difference between the two similar sounding processes. Both of these processes are carried whenever some connection attempt is made and whether the attempt has to be allowed or rejected is decided based up on these two factors only.
2. The basic goal of the authentication process is to verify whether you are who you claim to be or not? On the other hand the goal of the authorization is to set the access scope of the user who has been authenticated in the previous process. 

What is the difference between HTTP and HTTPS?

HTTP is quite a common language with us and stands for hyper text transfer protocol. This is actually an application protocol that has been developed exclusively for the hyper media, collaborative and distributed information systems. 

The foundation of the data communication is entirely based upon www or World Wide Web.  

Now what is HTTPS? HTTPS is nothing but HTTP secure! This one is much more secure than usual hyper text transfer protocol. And like HTTP, it is also a quite popular communication protocol for a much secure communication over a network of computers. It is quite popular with internet. 

If you see it technically, it is actually not a protocol in itself but rather a layered form of HTTP along with SSL/ TLS protocol. This allows the security capabilities of the SSL/ TLS to be added to the HTTP.  In this article we hold up to discuss the differences between the two i.e., the HTTP and HTTPS.

Difference #1:

- The transmission and receiving of the information across a computer network or internet is solely the responsibility of the HTTP.   

- HTTPS holds the responsibility of exchanging confidential information among the servers and also since the access to such information has to be secured to prevent it from any un- authorized access.

Difference #2:

-The transmission of HTTP takes place through a wire via PORT 80(TCP) but it is not at all secure! Some can easily interfere in the communication between your system and the server. 

- HTTPS is a creation of the NetScape and it comes as a built in thing with the netscape browser that uses it for the encryption and decryption of the user’s requests.

- HTTPS is actually HTTP working over the layer of netscape’s secure socket layer (SSL). 

- Unlike regular HTTP, HTTPS transmission takes place through a wire via PORT 443 for carrying out interactions between the lower layer TCP/ IP. 

- SSL or secure socket layer makes use of a 40 bit key size for encrypting the RC4 streams algorithm. 

- Therefore an adequate degree of encryption is possible for commercial exchange.

Difference #3:

- HTTPS being so very secure finds its use in shopping/ commercial sites and login pages. 

- HTTPS though being a standard secure protocol transmits the data over world wide web just like HTTP with the only difference being in the form in which data is transmitted i.e., the encrypted form. 

- When you put https:// instead of http:// you are asking the server to establish a secure connection path. 

- The server makes it a point that the secure and non secure connections are kept separately. 

- When the address in the address bar of the web browser that you are using, starts with http://, it simply means that your requests are being communicated over regular un-secure “HTTP” language.

- It is basically the letter ‘S’ that makes all the difference between HTTP and HTTPS. 

Difference #4:

- Most of the requests of the clients are processed via HTTP. The client in turn gets a response from the server on the completion of a request in the form of a web page. 

- In HTTPS the information is highly encrypted which means that no can have a clue of what you are looking for. 

This type of secure communication is commonly prevalent in those areas wheer security is quite mandatory like the following:

1. E- mails
2. Banking web sites
3. Payment gateways and so on.

To get an HTTPS connection, the server requires a public key trusted and signed certificate.

Quick Tip: URLs - Uniform Resource Locator

URLs, or Uniform Resource Locators, are the method by which documents or data are addressed in the World Wide Web. The URL contains the following information:

- the protocol.
- the DNS name of the machine on which the page is located.
- the local name uniquely indicating the specific page.
- the location of the resource in the directory structure of the server.

To make a piece of text clickable, the page writer must provide two items of information : the clickable text to be displayed and the URL of the page to go to if the text is selected. Once the text is selected, the browser looks up the host name using DNS. Now armed with the host's IP address, the browser establish TCP connection to host. Over that connection, it sends the file name using the specified protocol.
The URL scheme is open to have protocols other than HTTP also. In short, URL's have been designed to not only allow users to navigate the Web, but to deal with FTP, news, Gopher, email, and telnet as well, making all the specialized user interface programs for those other services unnecessary, and thus integrating nearly all Internet access into a single program, the Web Browser.
The growing use of the Web has turned up an weakness in URL scheme. A URL points to one specific host. For pages that are heavily referenced, it is desirable to have multiple copies far apart, to reduce network traffic. The advent of systems such as Akami are meant to meet that need, distributing content over multiple servers on a global level.

WWW - The Server Side

For all the incoming connectionts from different clients, every website is associated with a server process listening to TCP port 80. The client sends a request after the connection is made and the server sends the reply and then the connection is released. The protocol that is responsible for requests and replies is called HTTP.

The steps that occur between the user clicking and a page being displayed are:
- The browser determines the URL.
- The browser asks DNS for IP address.
- DNS replies.
- Browser makes a TCP connection to the port.
- It then sendsthe GET command.
- The server sends the file.
- The TCP connection is released.
- The browser displays the text of the file.
- The browser fetchesand displays all images of the file.

Not all servers speak HTTP, Old servers use FTP, Gopher or other protocols. Given the number of different protocols, it was thought impractical to make browser understand different protocols. However, since there is a need to make information available (where the server talks in protocols other than HTTP), a solution was required. This solution is something called a proxy server. A proxy server takes a HTTP request from the browser and translates these requests into the FTP/Gopher/other protocols. The proxy server is a separate logical server.
A proxy server also serves to provide an important function called caching. Through caching, a proxy server keeps a local copy of the pages that pass through it. If a user requests for a page, if the page is present on the cache of the proxy server, it serves the page to the user. this way it serves to reduce load on final server.

Introduction: WWW - The Client Side

The Internet / World Wide Web consists of pages and each page contains links or pointers to other pages. Users follow the link by clicking on them. This process can be repeated indefinitely, possibly traversing hundreds of linked pages. Pages that point to other pages are said to use "hypertext".

Pages are viewed with a program called a browser. When a page is requested, the browser fetches, interprets the text and formats the commands that it contains and displays the page. Strings of text that are links to other pages are called hyperlinks.

Most browsers have numerous buttons and features to navigate the Web. In addition to having ordinary text and hypertext, web pages also contain icons, line drawings, maps and photographs. Some pages also consist of audio tracks, video clips, or both. When hypertext pages are combined with other media, the result is called hypermedia. Many Web pages consists of large images which take a long time to load.

Some browsers deal with slow loading of images by first fetching and displaying the text, then getting the images. Some Web pages contain forms that request the user to enter information. Some browsers use the local disk to cache pages that they have fetched. A check is made before a page is fetched to see if it is in the local cache. If so, check if it is up to date. If so,there is no need to load the page again.

To host a web browser, a machine must be directly connected to Internet or have a SLIP or PPP connection to a router or other machine that is directly on Internet.

Quick Introduction to the World Wide Web (WWW) / Internet

The World Wide Web is an architectural framework for accessing linked documents spread out over thousands of machines all over the Internet. The World Wide Web began as a networked information project at CERN, where Tim Berners-Lee, now Director of the World Wide Web Consortium [W3C], developed a vision of the project.

The Web has a body of software, and a set of protocols and conventions. Through the use of hypertext and multimedia techniques, the web is easy for anyone to roam, browse, and contribute to.

World Wide Web can also be defined as system of Internet servers that support specially formatted documents. The documents are formatted in a markup language called HTML (HyperText Markup Language) that supports links to other documents, as well as graphics, audio, and video files. You can jump from one document to another simply by clicking on hot spots. Not all Internet servers are part of the World Wide Web. Web is basically a client-server system. Web pages are written in HTML and java.